Investment Rating - The report does not explicitly state an investment rating for the industry or specific companies. Core Insights - The report highlights the increasing significance of botnets as tools for geopolitical conflict, particularly in the context of recent global events such as the Russia-Ukraine war and the Israel-Palestine conflict, where botnets have been used for DDoS attacks against critical infrastructure [14][18]. - The report indicates that the threat landscape posed by botnets is escalating, with a notable increase in the number of command and control (C&C) servers and attack activities, particularly targeting domestic critical infrastructure [14][15]. - Botnets are increasingly being utilized as a launchpad for advanced persistent threats (APTs) and ransomware groups, enhancing their operational efficiency by gathering intelligence and facilitating subsequent attacks [15][43]. Summary by Sections Executive Summary - In 2024, the global landscape is marked by turmoil and challenges, with the cyber domain becoming a battleground for major powers, where botnets play a crucial role in state-sponsored cyber operations [14]. - Botnets have been observed to execute high-intensity DDoS attacks against critical infrastructure, manipulate public opinion, and express political stances during significant geopolitical events [14][15]. Botnet Development Trends - Botnets have evolved into essential tools for state-level cyber warfare, with their operational capabilities being leveraged for both offensive and defensive strategies in the digital realm [18]. - The report notes that the Mirai botnet family remains the most active, with the Mozi malware continuing to spread at high levels, primarily exploiting vulnerabilities in Linux/IoT platforms [14][15]. Botnet Vulnerability and Propagation - The report identifies that Linux/IoT botnets primarily exploit outdated vulnerabilities and weak passwords for propagation, while Windows platforms are more susceptible to phishing and social engineering tactics [59][67]. - The geographical distribution of infected devices shows that the United States has the highest number of infected endpoints, followed by India, Russia, and Brazil [70][71]. Botnet Attack Activity Analysis - The Mirai botnet family is responsible for the majority of attack commands issued, with a significant spike in activity noted in September 2024 [80]. - China is reported to be the most targeted country for DDoS attacks, accounting for 34% of all recorded incidents, necessitating enhanced protection for critical infrastructure [80].

Investment Rating - The report does not explicitly state an investment rating for the industry or company. Core Insights - The report highlights the increasing complexity and frequency of Advanced Persistent Threat (APT) attacks, which pose significant risks to national security and stability in the digital age [21][22]. - Collaboration between industry and academia, specifically between the report's company and Guangzhou University, aims to enhance early detection and response capabilities against APT threats through innovative technologies [22][24]. - The report provides a comprehensive analysis of APT organizations, detailing their activities, targets, and the evolving landscape of cyber threats [22][26]. Summary by Sections APT Attribution Tracking Situation Analysis - In 2024, a total of 51 APT organizations were monitored, with over 1,400 threat hosts controlled by these organizations, 50% of which originated from abroad [31][32]. - The number of APT organizations increased from 565 to 620, marking a 57.14% growth compared to 2023 [31][32]. - The report identifies that the education, healthcare, enterprise, and financial sectors were significantly impacted by APT activities [50]. APT Organization Intelligence Analysis - The report recorded 241 analysis reports on APT organizations in 2024, with Turla Group being the most analyzed [63][64]. - A total of 55 new APT organizations were added to the database, reflecting the dynamic nature of cyber threats [63][64]. - The report emphasizes the importance of understanding the geopolitical context influencing APT activities, particularly in regions like Eastern Asia and the Middle East [70]. APT Attack Methods Analysis - SSH and RDP brute force attacks accounted for 91% of the APT attack methods employed [58]. - The report indicates a significant increase in the number of vulnerabilities disclosed, with a focus on high-risk vulnerabilities in emerging technology areas [76]. - APT organizations are increasingly targeting supply chains, utilizing zero-day vulnerabilities to infiltrate systems [73].

Investment Rating - The report does not explicitly provide an investment rating for the low-altitude economy sector Core Insights - The low-altitude economy is emerging as a significant driver of economic growth, with applications ranging from drone logistics to urban air mobility, and is projected to reach a market size of 2.32 trillion yuan by 2024, with a compound annual growth rate (CAGR) of 11.51% over the next five years [11][27] - The rapid development of the low-altitude economy has highlighted the critical importance of cybersecurity, which is essential for ensuring the sustainable growth of this sector [11][21] - A comprehensive cybersecurity framework is proposed, focusing on business systems, industry collaboration, threat classification, emergency response, and supply chain security to address the complex and dynamic cybersecurity risks faced by the low-altitude economy [11][76] Summary by Sections 1. Industry Dynamics - The low-altitude economy is rapidly becoming a new engine for global economic growth, showcasing significant development potential and market prospects [20] - Various regions are demonstrating unique advantages in promoting the development of the low-altitude economy, particularly in technology innovation and application promotion [20][22] 2. Relevant Standards and Policies - A multi-layered framework of standards and policies related to low-altitude economy cybersecurity has been established, covering international, national, industry, and local levels [48] - Existing standards and policies require further refinement to effectively meet the specific needs and development trends of the low-altitude economy [48] 3. Cybersecurity Risks - The cybersecurity risks in the low-altitude economy are diverse and complex, including human-machine collaboration, system compatibility, communication reliability, illegal flights, and data security [64][66] - Major risk factors include technical failures, human errors, and environmental factors, which can significantly impact the safety and operation of low-altitude economic activities [66][68] 4. Cybersecurity Framework - The cybersecurity framework for the low-altitude economy emphasizes integrating security factors into business decision-making processes and fostering collaboration among various stakeholders [76][82] - The framework includes a focus on the security of onboard intelligent algorithms, threat classification, emergency response, and supply chain security [76][109] 5. Future Trends - The report anticipates that the low-altitude economy will continue to evolve, necessitating ongoing advancements in cybersecurity measures to protect against emerging threats [11][18]

Investment Rating - The report does not explicitly provide an investment rating for the low-altitude economy sector Core Insights - The low-altitude economy is emerging as a significant driver of economic growth, with applications ranging from drone logistics to urban air mobility, and is expected to reach a market size of 2.08 trillion yuan in 2023, growing to 2.32 trillion yuan in 2024, with a compound annual growth rate of 11.51% over the next five years [14][16] - Network security is a critical concern for the sustainable development of the low-altitude economy, necessitating a comprehensive security framework that includes business systems, industry cooperation, threat classification, emergency response, and supply chain security [2][41] Summary by Sections Low-altitude Economy Development Overview - The low-altitude economy utilizes airspace resources below 3,000 meters, involving various aircraft types, including drones and eVTOLs [12] - The global low-altitude economy market is projected to grow significantly, with North America leading due to policy support and technological innovation, holding over 40% market share [14][15] Low-altitude Economy Network Security Standards and Policies - A multi-layered framework of standards and policies has been established, covering international, national, industry, and local levels, although further refinement is needed to meet the specific needs of the low-altitude economy [26][28] Low-altitude Economy Network Security Risks - The low-altitude economy faces diverse and complex security risks, including human-machine collaboration, communication reliability, system compatibility, illegal drone flights, and network security threats [31][32][33][35][36] Low-altitude Economy Network Security System - A robust network security system is essential for the low-altitude economy, focusing on integrating security into business processes, fostering industry collaboration, and enhancing threat classification and emergency response capabilities [41][62] Low-altitude Economy Network Security Trends - The report emphasizes the need for continuous improvement in security measures, including data encryption, integrity verification, and the adoption of advanced technologies to mitigate risks associated with the low-altitude economy [60][64]

Industry Overview - The report focuses on the global cloud data leakage risks in the first half of 2024, highlighting the increasing security risks associated with public and hybrid cloud environments [7] - A total of 16 cloud data leakage incidents occurred globally in the first half of 2024, involving approximately 1.2 billion pieces of personal data [7] - The United States experienced the highest number of incidents (8), with retail being the most affected industry, accounting for 940 million leaked records [7] Key Incidents - **Escapada Rural**: A Spanish rental company leaked 2.9 million customer records due to misconfigured Amazon S3 storage [13][14] - **Glosbe**: An online dictionary exposed nearly 7 million user records, including encrypted passwords and social media identifiers, due to an unprotected MongoDB database [17][18] - **Google Firebase**: Over 125 million user records were exposed across 900 websites due to hardcoded Firebase credentials [21][22] - **Ticketmaster**: Approximately 560 million user records were leaked, including payment information, due to a credential leak in Snowflake [36][37] - **AT&T**: Around 110 million user call records were stolen from Snowflake, marking another major credential-based breach [48][49] - **Toyota**: 240GB of employee and customer data, including financial and contract information, was stolen by a hacker group [52][53] Incident Analysis - **Miscellaneous Errors**: 11 out of 16 incidents were caused by misconfigurations, leading to 25.67 million data leaks [7] - **System Intrusion**: 4 incidents involved system intrusions, resulting in 1.05 billion data leaks [7] - **Basic Web Application Attacks**: 1 incident was due to web application attacks, exposing 125 million records [7] Security Recommendations - **For Misconfigurations**: Implement access control lists (ACLs), disable anonymous access, and monitor access requests [58][59][60] - **For System Intrusions**: Enable multi-factor authentication (MFA), rotate access keys, and encrypt sensitive data [61] - **For Web Application Attacks**: Establish anti-crawling mechanisms, enforce MFA, and limit login attempts [62] Conclusion - The report emphasizes the importance of understanding cloud data leakage risks and provides detailed insights into attack techniques using the MITRE ATT&CK framework [65] - Green Alliance Innovation Research Institute continues to monitor cloud risks and has developed tools like Fusion for automated asset detection and risk assessment [65][66]